CAMEL-24085: Apply header filter strategy to IronMQ message envelope headers (4.18.x backport)#24905
Conversation
…headers (4.18.x backport) The IronMQ consumer deserializes a JSON envelope (a headers map and a body) and copied the embedded header entries onto the Camel message without applying a HeaderFilterStrategy. Route the envelope headers through a HeaderFilterStrategy so Camel* headers (matched case-insensitively) present in the sender-controlled envelope are filtered, consistent with the inbound header filtering performed by other consumers. Backport to camel-4.18.x: the strategy sets setInFilterStartsWith(CAMEL_FILTER_STARTS_WITH) explicitly, since DefaultHeaderFilterStrategy on this branch does not filter Camel* inbound by default. Test support uses junit5 on this branch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
gnodet
left a comment
gnodet
left a comment
There was a problem hiding this comment.
Review: CAMEL-24085 — IronMQ header filter strategy (4.18.x backport)
Clean backport of #24828 (merged on main). Applies a `HeaderFilterStrategy` to IronMQ message envelope headers to prevent header-injection attacks (CVE-2025-27636 family).
What works well
-
Correct security fix — Filters `Camel*`/`camel*` headers from untrusted IronMQ message envelopes before they reach the Camel exchange, preventing injection of internal headers like `CamelFileName` (path traversal) or `camelExecCommandExecutable` (command injection).
-
Branch-appropriate adaptation — On `camel-4.18.x`, `DefaultHeaderFilterStrategy` does not filter `Camel*` inbound by default (pre-CAMEL-23543), so the backport explicitly sets `setInFilterStartsWith(CAMEL_FILTER_STARTS_WITH)`. This is the correct approach for this branch.
-
Static strategy — The `HeaderFilterStrategy` is created once as a static field, avoiding per-message allocation overhead. Thread-safe since `DefaultHeaderFilterStrategy` is immutable after configuration.
-
Good test — Verifies both `CamelFileName` (PascalCase) and `camelExecCommandExecutable` (camelCase) are filtered while regular headers (`MyHeader`) and IronMQ-specific headers (`MESSAGE_ID`) are preserved.
-
Test correctly uses `junit5` for this branch (not junit6).
No issues found. Straightforward security backport.
Claude Code on behalf of gnodet — AI-generated review
3 participants
Backport of #24828 (merged on main, CAMEL-24085) to
camel-4.18.x.Branch adaptations, mirroring the CAMEL-24084 knative backport (#24753):
DefaultHeaderFilterStrategyon this branch does not filterCamel*inbound by default (pre-CAMEL-23543), so the strategy setssetInFilterStartsWith(CAMEL_FILTER_STARTS_WITH)explicitly. The newIronMQConsumerHeaderFilterTestpasses on this branch, verifying the filter is effective.org.apache.camel.test.junit5(this branch is not on junit6).camel-4x-upgrade-guide-4_18.adoconmainvia a doc-sync PR.Testing:
mvn clean installincomponents/camel-ironmq(all tests pass, including the new filter test); full reactormvn clean install -DskipTestsfrom the branch root: success, no stale generated files.Claude Code on behalf of Andrea Cosentino (@oscerd).
🤖 Generated with Claude Code